Managing the Amazon EBS CSI driver as an Amazon EKS add-on

aws.com

• An existing AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster.

aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text

https://oidc.eks.us-east-1.amazonaws.com/id/187054FB6DBFE10DA216A01234567890

aws eks create-addon --cluster-name my-cluster --addon-name aws-ebs-csi-driver \
  --service-account-role-arn arn:aws:iam::111122223333:role/AmazonEKS_EBS_CSI_DriverRole

Official example

 {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringEquals": {
             "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com",
             "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa"
           }
         }
       }
     ]
   }
ref: Managing the Amazon EBS CSI driver as an Amazon EKS add-on

Errors

• failed to provision volume with StorageClass
• Could not create volume in EC2: UnauthorizedOperation

Activities

• Configure privileges for EBS CSI using ebs_csi_irsa_role module
• Creating an IAM OIDC provider for your cluster

Related

• kubectl describe pvc
• sts:AssumeRoleWithWebIdentity
• Creating the Amazon EBS CSI driver IAM role for service accounts
• EKS module: cluster_addons
• aws_iam_role
• Terraform module: ebs_csi_irsa_role

See also

• Amazon EBS CSI driver: aws-ebs-csi-driver, ebs_csi_irsa_role, ebs-csi-controller, ebs-csi-node
• EBS, EBS Snapshots (archive), Encryption, aws ebs, io1, io2, gp2, gp3, st1, sc1, aws_ebs_snapshot, aws_dlm_lifecycle_policy
• OpenID Connect (OIDC), kubectl oidc-login, AWS IAM OIDC, EKS OIDC, EKS module, aws iam list-open-id-connect-providers | aws iam create-open-id-connect-provider | aws iam get-open-id-connect-provider, OIDC tokens, aws_lb_listener_rule, Google Cloud Identity, Claims, keycloak_oidc_identity_provider, settings, OIDC client, client_id, client_secret, Authorization Code Flow, OIDC Web App, Back-Channel